CVE-2026-69232: Esri Portal for ArcGIS XSS Vulnerability

CVE-2026-69232 Overview

CVE-2026-69232 is a stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.5 and prior. A remote, privileged attacker can inject malicious payloads that execute arbitrary JavaScript in a victim's browser when the affected content is rendered. The flaw is tracked under CWE-79, Improper Neutralization of Input During Web Page Generation. Esri recommends that customers running ArcGIS Enterprise 11.1, 11.3, and 11.5 apply the vendor patch, and that all users migrate to the latest long-term support release.

Critical Impact
Authenticated attackers with elevated privileges can persist JavaScript payloads that execute in the sessions of other Portal users, enabling session abuse, UI manipulation, and pivoting within ArcGIS Enterprise deployments.

Affected Products

Esri Portal for ArcGIS 11.1
Esri Portal for ArcGIS 11.3
Esri Portal for ArcGIS 11.5 and prior

Discovery Timeline

2026-08-21 - CVE-2026-69232 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-69232

Vulnerability Analysis

CVE-2026-69232 is a stored XSS defect in Esri Portal for ArcGIS, the web portal component of ArcGIS Enterprise used for content management, sharing, and administration. The application fails to properly neutralize attacker-controlled input before storing it and rendering it back to users in HTML context. Because the payload persists server-side, every user who loads the affected view executes the injected script under the Portal origin. Exploitation requires network access and a high-privilege account, and it changes trust scope by executing in a victim's authenticated session.

Root Cause

The root cause is missing or insufficient output encoding on user-supplied fields that are rendered in the Portal user interface. Input that should be treated as inert data is emitted into HTML or attribute context without contextual escaping, allowing embedded <script> blocks or event-handler attributes to execute. This is a classic [CWE-79] pattern where trust boundaries between stored data and rendered markup are not enforced.

Attack Vector

An attacker with a privileged Portal account submits a crafted payload through a field that stores content on the server. When another user, including administrators, views the affected item, group, or page, the browser parses the payload and runs it in the Portal's origin. The attacker can steal session state, issue authenticated API calls to ArcGIS Enterprise, modify shared content, or stage further attacks against Portal administrators. No verified public exploit is available at the time of writing.

See the Esri ArcGIS Security Bulletin for vendor technical details.

Detection Methods for CVE-2026-69232

Indicators of Compromise

Portal items, descriptions, comments, or group metadata containing <script> tags, javascript: URIs, or DOM event handlers such as onerror= and onload=.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing Portal content.
Portal audit entries showing content edits by privileged accounts followed by anomalous administrative actions performed by other users.

Detection Strategies

Scan Portal content stores and backups for HTML or JavaScript patterns in fields that should hold plain text or Markdown.
Deploy web application firewall rules that flag script-like payloads submitted to /sharing/rest/ content and group endpoints.
Correlate privileged content-modification events with subsequent session anomalies to identify stored-XSS staging.

Monitoring Recommendations

Enable and centralize Portal for ArcGIS access and admin logs in a SIEM for content-modification review.
Alert on new or modified items created by administrator-tier accounts containing HTML markup.
Monitor Content Security Policy (CSP) violation reports from Portal to surface injected script execution attempts.

How to Mitigate CVE-2026-69232

Immediate Actions Required

Apply the Esri security patch for ArcGIS Enterprise 11.1, 11.3, or 11.5 as documented in the vendor bulletin.
Audit privileged Portal accounts and remove unused administrator or publisher roles to reduce exposure.
Review recently created or modified Portal items for embedded HTML or scripting content and remediate suspicious entries.

Patch Information

Esri has released patches addressing CVE-2026-69232 for supported ArcGIS Enterprise releases. Refer to the Esri ArcGIS Security Bulletin for the specific patch identifiers per version and installation instructions. Esri also advises upgrading to the latest long-term support release for ongoing coverage.

Workarounds

Restrict Portal administrator and publisher privileges to a minimal, well-audited set of accounts until patching is complete.
Enforce a strict Content Security Policy on the Portal web tier to limit inline script execution.
Require multi-factor authentication for privileged Portal roles to raise the cost of account compromise that enables injection.

bash

# Configuration example
# Refer to the Esri ArcGIS Security Bulletin for version-specific patch commands.
# https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/august-2026-arcgis-security-bulletin